Overview
overview
10Static
static
10Apache_Ope...es.exe
windows10-ltsc 2021-x64
6$PLUGINSDI...ns.dll
windows10-ltsc 2021-x64
3stat.py
windows10-ltsc 2021-x64
3stats.py
windows10-ltsc 2021-x64
3statvfs.py
windows10-ltsc 2021-x64
3stl_01.ott
windows10-ltsc 2021-x64
3stl_02.ott
windows10-ltsc 2021-x64
3stl_03.ott
windows10-ltsc 2021-x64
3swui.dll
windows10-ltsc 2021-x64
3symbol.py
windows10-ltsc 2021-x64
3symbols.py
windows10-ltsc 2021-x64
3symtable.py
windows10-ltsc 2021-x64
3synchronize.py
windows10-ltsc 2021-x64
3syntax.py
windows10-ltsc 2021-x64
3sysconfig.py
windows10-ltsc 2021-x64
3sysconfig1.py
windows10-ltsc 2021-x64
3sysdtrans.dll
windows10-ltsc 2021-x64
3sysmail.uno.dll
windows10-ltsc 2021-x64
3syssh.uno.dll
windows10-ltsc 2021-x64
3t602filter.dll
windows10-ltsc 2021-x64
3tabbedpages.py
windows10-ltsc 2021-x64
3table.jar
windows10-ltsc 2021-x64
1tabnanny.py
windows10-ltsc 2021-x64
3tarfile.py
windows10-ltsc 2021-x64
3telnetlib.py
windows10-ltsc 2021-x64
3tempfile.py
windows10-ltsc 2021-x64
3textoutstream.uno.dll
windows10-ltsc 2021-x64
3openoffice4115.msi
windows10-ltsc 2021-x64
6readmes/re...s.html
windows10-ltsc 2021-x64
4redist/vcr...64.exe
windows10-ltsc 2021-x64
7redist/vcr...86.exe
windows10-ltsc 2021-x64
7setup.exe
windows10-ltsc 2021-x64
7Analysis
-
max time kernel
439s -
max time network
447s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-es -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-eslocale:es-esos:windows10-ltsc 2021-x64systemwindows -
submitted
22/01/2025, 15:18
Behavioral task
behavioral1
Sample
Apache_OpenOffice_4.1.15_Win_x86_install_es.exe
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral2
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral3
Sample
stat.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral4
Sample
stats.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral5
Sample
statvfs.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral6
Sample
stl_01.ott
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral7
Sample
stl_02.ott
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral8
Sample
stl_03.ott
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral9
Sample
swui.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral10
Sample
symbol.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral11
Sample
symbols.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral12
Sample
symtable.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral13
Sample
synchronize.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral14
Sample
syntax.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral15
Sample
sysconfig.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral16
Sample
sysconfig1.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral17
Sample
sysdtrans.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral18
Sample
sysmail.uno.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral19
Sample
syssh.uno.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral20
Sample
t602filter.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral21
Sample
tabbedpages.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral22
Sample
table.jar
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral23
Sample
tabnanny.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral24
Sample
tarfile.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral25
Sample
telnetlib.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral26
Sample
tempfile.py
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral27
Sample
textoutstream.uno.dll
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral28
Sample
openoffice4115.msi
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral29
Sample
readmes/readme_es.html
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral30
Sample
redist/vcredist_x64.exe
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral31
Sample
redist/vcredist_x86.exe
Resource
win10ltsc2021-20250113-es
Behavioral task
behavioral32
Sample
setup.exe
Resource
win10ltsc2021-20250113-es
General
-
Target
redist/vcredist_x86.exe
-
Size
4.3MB
-
MD5
35da2bf2befd998980a495b6f4f55e60
-
SHA1
470640aa4bb7db8e69196b5edb0010933569e98d
-
SHA256
6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6
-
SHA512
bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2
-
SSDEEP
98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4172 install.exe -
Loads dropped DLL 1 IoCs
pid Process 4172 install.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language install.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2072 wrote to memory of 4172 2072 vcredist_x86.exe 81 PID 2072 wrote to memory of 4172 2072 vcredist_x86.exe 81 PID 2072 wrote to memory of 4172 2072 vcredist_x86.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\redist\vcredist_x86.exe"C:\Users\Admin\AppData\Local\Temp\redist\vcredist_x86.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\a7432e32469653963a3323e3981333a4\install.exec:\a7432e32469653963a3323e3981333a4\.\install.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
547KB
MD54138c31964fbcb3b7418e086933324c3
SHA197cc6f58fb064ab6c4a2f02fb665fef77d30532f
SHA256b72056fc3df6f46069294c243fe5006879bf4a9d8eef388369a590ca41745f29
SHA51240cf2f35c3a944fca93d58d66465f0308197f5485381ff07d3065e0f59e94fc3834313068e4e5e5da395413ff2d3d1c3ff6fa050f2256e118972bf21a5643557
-
Filesize
1KB
MD50a6b586fabd072bd7382b5e24194eac7
SHA160e3c7215c1a40fbfb3016d52c2de44592f8ca95
SHA2567912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951
SHA512b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4
-
Filesize
841B
MD5f8f6c0e030cb622f065fe47d61da91d7
SHA1cf6fa99747de8f35c6aea52df234c9c57583baa3
SHA256c16727881c47a40077dc5a1f1ea71cbb28e3f4e156c0ae7074c6d7f5ecece21d
SHA512b70c6d67dac5e6a0dbd17e3bcf570a95914482abad20d0304c02da22231070b4bc887720dbae972bc5066457e1273b68fde0805f1c1791e9466a5ca343485cde
-
Filesize
90KB
MD5dbbe392a7536c76ec60a21e211eb3210
SHA1e1cead8b1e0fd41e9ed79f4921c5e40c2d739dda
SHA2568de447ae460de91144ec92381c8315a125b25020ac7601bbb721d56a92d0fd0f
SHA512f725bc786076947874cc58b9591445064b3f133c75865bb1d661e95f29f1a9556447ee3f385a38f9438561e35e6cfa8208dbc938d3304c415cc25ed85c29f15d
-
Filesize
222KB
MD57e641e6a0b456271745c20c3bb8a18f9
SHA1ae6cedcb81dc443611a310140ae4671789dbbf3a
SHA25634c5e7d7ea270ee67f92d34843d89603d6d3b6d9ef5247b43ae3c59c909d380d
SHA512f67d6bf69d094edcc93541332f31b326131ff89672edb30fd349def6952ad8bfd07dc2f0ca5967b48a7589eee5b7a14b9a2c1ebe0cba4ae2324f7957090ea903
-
Filesize
5KB
MD506fba95313f26e300917c6cea4480890
SHA131beee44776f114078fc403e405eaa5936c4bc3b
SHA256594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1
SHA5127dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd